(Updated With New Details) TouchWiz Exploit Can Reset A Device Just By Visiting A Website

Samsung Galaxy S II and S III owners beware as an exploit caused by a single line of code can cause an unstoppable factory reset of your Samsung device. Posted by Pau Oliva earlier in the day, the code was at first only thought to affect the Galaxy S II however, new reports since this morning have indicated that a number of other Samsung devices, including the Galaxy S III suffer from the same exploit.

The hack itself is a simple USSD code, that can be sent from a website and triggered by NFC, or a QR code that can cause the device to reset. For now, only Samsung devices running TouchWiz seem to be affected. The danger can run a little deeper if someone were to introduce a USSD code to your device that can both wipe the phone and leave the user with a broken SIM as well.

For now, the advice is to deactivate any automatic site-loading in any QR and/or NFC reader software you have installed on your device. Of course, the safest way to prevent any harm is your own awareness and not clicking on any links you don’t trust. We’d also urge you to use a browser other than the default browser on your Samsung device until a patch is implemented to prevent any harm.

For Galaxy Nexus owners, thanks to your stock Android platform, there is no danger. Also, thanks to TmoNews reader @Jaxidian, who determined that no AOSP based ROM (CM10, AOKP, etc) are vulnerable, nor the leaked TouchWiz Jelly Bean updates for the Galaxy S III.

We’ll keep and eye on this and post any updates as they become available.

More info below:

DroidDog, Pau Oliva, Steve Troughton-Smith, The Verge

Update: As you can see in this video, the Galaxy S III, with the most recent maintenance update is no longer subject to this exploit as a patch has been applied. Furthermore, the exploit is not found in the Galaxy S III Jelly Bean update. Check the video for details:

Tags: , , , , ,

  • jmickelonis

    Wow. Does that also mean that a similar frame embed could be used to trigger outgoing phone calls? Seems like quite an oversight by Samsung.

    • psaux

      What you see as oversight I’m sure they see as a convenience feature meant to help them try to be simpler for user=ID10T type configurations than Apple.

      • jmickelonis

        You’re totally right, I’m sure it was put there on purpose.

    • PaulC

      I’m just guessing, but I bet you have to hit “dial” one last time to make a call, but these special codes probably *don’t* need you to hit “dial” so that opens up a vulnerability.

  • Ray Dull

    Yes this would cause an outgoing call, all thats doing is dialing the samsung factory reset code that they’ve used since way before android even existed, even back before cell phones had color screens.

  • Steven Miller
  • Guest

    This is obviously fake and set up, just like the drop test against the iPhone in the other video!!!111

    • Paul

      Ha ha ha

  • Guest
  • contriver87

    The browser exploit doesn’t work on the T-Mobile Galaxy S III (SGH-T999) as long as you have done the latest update. I have tried it myself and the only thing that happens is the dialer opens with a blank input area. The Verge was able to perform the exploit on the S3 because they have a review unit that isn’t updated to the latest version.

    • Chris

      Yep, said the same thing. They have blown this out of proportion.

  • Guest

    Duplicate…Sorry about that.

  • Paul

    Thank you rooted S2 and Nova launcher!

  • s10shane

    damn low life people with nothing better to do but hack shit. cant stand people like that.

  • Ulysses Geist

    Wow, you’ve been samsunged.

  • Splaktar

    Glad that I don’t run TouchWiz on my SGS2!

  • mreveryphone

    More of a reason to get jelly bean out

  • MasterSyrron

    Does not work on the Sprint S3.